A race condition in netlink socket creation can trigger a kernel panic in netlinkrelease->moduleput for local users creating netlink sockets.

This issue is specific to Red Hat Enterprise Linux and does not affect upstream kernels. This issue was introduced in commit 3500659804251facce0cf4ee2ca657e0108e9a4f. This was introduced in kernel-3.10.0-304.el7 in the fix titled:

[net] netfilter: log: protect nflogregister against double registering.

It requires the nfnetlinklog module to be loaded to be effective.

This commit was introduced as part of a patchset that was required to backport netfilter functionality from upstream while attempting to maintain KABI. This flaw is RHEL specific.

A vulnerability was found in kexec, allowing the attacker to bypass the security mechanism of securelevel/secureboot combination.

When the kernel was booted with UEFI Secure Boot enabled, securelevel is set. If kexec (either through crash or admin action) is then used to load the same kernel, after reboot securelevel is disabled. In this state, the system is missing the protections provided by securelevel, for example kexec may be used to load an unsigned kernel via the legacy system call kexecload. In the securelevel patchset, the state of UEFI Secure Boot is queried in the EFI stub, and sets a bootparams flag to indicate the state of UEFI Secure Boot. This flag is then used in setuparch() to determine the correct state of securelevel. If the kernel is not booted via the EFI stub, securelevel is not set even if UEFI Secure Boot is enabled.

Patch can be found in product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1243998#c3

Upstream patch:

https://github.com/mjg59/linux/commit/4b2b64d5a6ebc84214755ebccd599baef7c1b798

CVE assignment:

http://seclists.org/oss-sec/2015/q4/85